Privacy Policy
Superhyre Contact Finder

Chrome extension · Effective date: 14 October 2026

This policy explains how the Superhyre Contact Finder browser extension (“the Extension”) handles data. It is a business tool for authorized users of superhyre. It requires signing in with a work Google account; personal-email accounts are refused at signup.

What the Extension accesses

The Extension runs only on https://www.linkedin.com/*. With the sidebar closed it reads nothing on a profile page and sends nothing anywhere.

When the sidebar is open on a profile page (https://www.linkedin.com/in/…) it reads, from that page only:

• the canonical profile URL (the /in/<slug> identifier, with tracking parameters stripped);
• the name, headline, current title and company, location, the About text, and the education and experience entries shown on the page.

These are used to show the person in the sidebar and, when you look someone up or add them to your sheet or a job, to save them.

On a LinkedIn people-search results page it reads the canonical profile URLs of the visible results — up to fifty per page — to mark the people already in your pipeline with a dot. This happens while you are signed in, whether or not the sidebar is open, because the dots are drawn on the results list itself.

On a LinkedIn company page (https://www.linkedin.com/company/…), when a member of superhyre’s own team opens Company employees, the Extension reads the page’s address to fill in the company. It reads nothing else on that page.

When you choose to upload a job description (Add to job), the Extension reads the file you pick (PDF, DOCX or TXT, up to 10 MB). It reads no other file.

That is the entire read surface. The Extension does not read your LinkedIn feed, connections or messages, or any other page or site, and it does not run on any other domain.

What the Extension stores on your device

Using Chrome’s local storage (chrome.storage.local), the Extension stores only:

• your Supabase session (access and refresh token) from signing in with Google;
• your sidebar preferences: open or closed, width, whether it is pinned, and where you placed its edge tab;
• the job you selected to add people to, if any;
• once you allow Google Sheets, a short-lived Google access token for it (about an hour) and a note that you allowed it, both removed when you sign out;
• for superhyre’s own team only, the progress of a Company employees export (the company, the spreadsheet it writes to, and how many rows are written), until you dismiss it;
• for a few seconds, a flag that opens the sidebar on the LinkedIn tab you opened from the Extension’s popup.

There are no API keys on your device — see “Where the provider keys live” below. The Extension contains no analytics, advertising, tracking or telemetry code, and stores no browsing or lookup history locally.

What the Extension transmits, and to whom

1. Google sign-in (accounts.google.com). Signing in asks only for your identity. The Google Sheets permissions are asked for separately, the first time you add someone to your sheet or a job (or, for superhyre’s own team, start a Company employees export), and you can decline them and keep using everything else. The scopes are:

• openid, email, profile — your email address and name, to sign you in (at sign-in);
• drive.file — to create your contacts spreadsheet and a job’s shared spreadsheet, and to share a job’s spreadsheet with your teammates. It covers only files the Extension itself creates; it cannot see anything else in your Drive;
• spreadsheets — to write rows into those spreadsheets, including a job’s spreadsheet that a teammate created and shared with you, which drive.file alone cannot write to. The Extension reads and writes only the spreadsheets it created for you or that are recorded as your team’s job spreadsheets, and only to add or update the rows described in point 2. It does not read, list or change any other spreadsheet you have.

It requests no access to Gmail, Calendar, or any other Google service.

2. Google Sheets and Drive APIs (sheets.googleapis.com, www.googleapis.com), with your own Google sign-in. When you add someone to your sheet or a job, the Extension writes one row for that person: name, LinkedIn URL, the phone numbers and email addresses your account is allowed to see, title, company, location, education, work experience, bio, notes, the date and time they were added, and who added them (your name). It reads the existing rows of that spreadsheet only to find and update the same person’s row instead of adding a duplicate. A lookup never adds a row: it only updates the row of someone already in your sheet or on the job, with the details your account can now see. A row is also updated once their public profile details (bio, work experience, education) arrive, shortly after they are first saved. When a job’s spreadsheet is first created, it is shared as an editor with the active members of your organization. When you take someone off a job, their row is removed from that job’s spreadsheet. A Company employees export (superhyre’s own team only, see point 7) creates a new spreadsheet of its own in your Drive and writes one row per employee into it.

3. superhyre’s Supabase project (npqajviolhoufuggfobg.supabase.co). It receives, as you use the Extension:

• the profile URL you are viewing, each time the sidebar shows a profile (a free lookup of what your account already has);
• up to fifty result profile URLs per people-search page, to find which of them are already in your pipeline;
• the profile fields listed above, when you look someone up or add them to your sheet or a job;
• a candidate record in your organization’s pipeline (or your personal workspace), stamped as sourced from the Extension. It is created when you add someone to your sheet or a job, and automatically after a lookup, since looking someone up is treated as the intent to work them;
• jobs: when you create a job, its company, role, location, experience range, skills and the text of the job description; when you add or remove someone, the shortlist entry on that job;
• a log entry for each lookup: your user id, your organization, the profile URL, the outcome and a timestamp. It enforces your credit balance and records spend;
• activity entries for job and sheet actions (who added or removed whom, on which job, and when), written to your workspace’s activity log so your team can see them on the Activity page;
• the job description file you upload, so superhyre’s server can read it (see point 5).

4. Contact-data and profile-data providers — reached by superhyre’s server, never by your browser. When you look up a phone number or email, superhyre’s server sends the LinkedIn profile URL — and nothing else — to independent third-party contact-data providers, one at a time, until one has a match. A provider that has already answered about a profile is not asked about it again for 90 days: what it returned is kept and reused instead. When a person is saved, superhyre’s server may also send their LinkedIn profile URL to a third-party profile-data service to fill in public profile details (work history, education, skills). These providers’ handling of a request is governed by their own terms and privacy policies.

5. An AI model — reached by superhyre’s server, never by your browser. When you upload a job description, superhyre’s server turns the file into text and sends that text to an AI model (Anthropic’s Claude) to pick out the company, role, skills and experience, which you then check before the job is created. Only the job description text is sent: no profile, contact or Google data. It is not used to train any model.

6. Gmail, only when you click. Request credits and Contact us open Gmail’s compose window in a new tab with a draft addressed to superhyre. Nothing is sent unless you press Send, and the Extension has no access to your Gmail.

7. Company employees — superhyre’s own team only, and only after you confirm. This action is shown only to members of superhyre’s own workspace, and superhyre’s server refuses it for every other account. It starts only from its confirmation button, and only once the Google Sheets permission is in place: the destination spreadsheet is created first, and if it cannot be, nothing is started. superhyre’s server then sends the company’s LinkedIn page address or name, any locations you entered and the maximum number of profiles to a third-party profile-data service, which returns the public LinkedIn profiles of people listed as that company’s employees (name, profile URL, headline, location, current position, work history, education). The Extension writes them into the new spreadsheet in your Drive, in the same columns as your other sheets. They are not added to anyone’s pipeline, and no phone numbers or email addresses are looked up.

The Extension sends data to no other destination. Its manifest grants host access to exactly three hosts — superhyre’s Supabase project, sheets.googleapis.com and www.googleapis.com — so it is technically incapable of contacting a provider, an analytics service, or anything else directly.

Where the provider keys live

The provider and AI API keys are held as secrets in superhyre’s Supabase project and are never present in the Extension. An unpacked extension is readable by anyone who has it, so a key shipped inside it would be a key its users have. The only credential in the Extension bundle is a Supabase publishable key, which is public by design and cannot by itself read data or spend a credit: every action requires your signed-in user token, and access is enforced in the database.

Shared contact data — please read

Contact details that are found are stored in a person graph shared across all organizations using the Superhyre platform, so that the same person is not paid for twice. What each account can see is limited:

• An account (an organization, or a user without one) sees a person’s details only after it has asked for them itself, or already holds them. Email addresses and phone numbers are opened separately: Access email (free) shows the email addresses, Access phone number the phone numbers. A number another organization found is shown to you only when you look the person up, and that lookup uses one of your credits.
• A provider may return more than was asked for (for example an email address alongside a phone number). It is kept in the shared person graph so that it is not paid for again, but it is shown to your account, and copied into your organization’s records, only when you ask for it.
• Numbers that are not a person’s own (office switchboards, toll-free lines, malformed values) are not kept or shown.
• Your organization’s own work — who is shortlisted, on which job, their stage, your notes, who owns them, your activity — is stored in a space private to your organization and is not visible to any other organization. Within your organization, teammates can see each other’s jobs, shortlists and activity.

Data subjects, controllers, and responsibilities

The profile data and contact details processed relate to third-party individuals (“data subjects”). superhyre is the data controller for everything the Extension writes to superhyre’s systems. The spreadsheets in your Google Drive are yours and your organization’s.

Depending on your and the data subject’s location, applicable law (e.g. GDPR, CCPA/CPRA, India’s DPDP Act) may grant data subjects rights to access, correct, or delete this data. Requests can be directed to team@superhyre.com; a specific person’s record can be deleted on request, including from the shared person graph.

You are responsible for using the Extension in compliance with applicable law, LinkedIn’s terms, and your organization’s policies.

Limited use

We use the data described above only to provide the Extension’s function — finding recruiting contacts on LinkedIn and saving them, with their profile, into your Superhyre pipeline, your jobs and your Google Sheets — and to operate, secure and bill for it.

• We do not sell this data, or transfer it to third parties, other than the contact-data and profile-data providers and the AI model described above, used solely for the request you made.
• We do not use or transfer it for any purpose unrelated to that function: no advertising, no profiling, no resale.
• We do not use or transfer it to determine creditworthiness or for lending purposes.
• The Extension contains no analytics, advertising or tracking code of any kind.

Google user data. Superhyre’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google account (your name, email address, and the spreadsheets described above) is used only to sign you in and to write and update your contact and job spreadsheets. It is not sold, not used for advertising, not read by humans except with your consent or for security and legal reasons, and not used to develop, improve or train AI or machine-learning models.

Permissions and why they are needed

• storage — to keep your session and the preferences listed above on your device.
• identity — to sign you in with Google, in Google’s own consent window. The Extension never sees your Google password.
• host access to npqajviolhoufuggfobg.supabase.co — superhyre’s server.
• host access to sheets.googleapis.com and www.googleapis.com — to create, share and write the spreadsheets described above.
• content script on www.linkedin.com — to show the sidebar and read the fields described above.

The Extension requests no tabs, history, cookies, webRequest, scripting or all-sites permission, and executes no remotely hosted code: every line it runs ships inside the package.

Data retention

Your session stays on your device until you sign out or uninstall; signing out deletes it. Contact, candidate, job and activity data is retained in superhyre’s systems until deleted on request or as part of its normal data lifecycle. Lookup log entries are retained for billing, abuse-prevention and audit purposes, and are deleted with the user account they belong to. Uploaded job description files are not kept; the text read from them is kept with the job. Spreadsheets in Google Drive stay there until you or your organization delete them.

Children

The Extension is a business tool and is not directed to anyone under 16.

Changes

We may update this policy; the “Effective date” above will change and the updated policy will be posted at this URL.

Contact

Questions or data requests: team@superhyre.com (superhyre, Bangalore, India).